WaratekVRT Sign in

CVE-2021-27358 Grafana

Affected softwareGrafana
Severity7.5 High CVSS 3.1 2 scores
Published18 Mar 2021
Updated17 Jun 2026

Description

The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. Honeypot sightings · earliest 2026-05-01.
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed Published artifacts you can open, in Nuclei.
  • EPSS 83% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.7% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-27358 in VulnCheck (free account).

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 115 days 2026-05-01 to 2026-11-10
IndexArtifactStarsFirst seen
Nuclei Grafana Unauthenticated Snapshot Creation

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached
Finding This CVE names only products the Waratek agent cannot be installed into (netapp/e-series_performance_analyzer). They ship as sealed appliance images or as native code with no application JVM, so there is no start-up line to add -javaagent to. The vulnerability may well be a Java one; it is permanently out of ARMR's reach rather than outside its subject.

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary published
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:N/I:N/A:P NVD Primary

Affected software and releases

Products and versions

2 products, 2 version entries
SourceVendorProductSchemeAffected versions
nvd grafana grafana generic ≥ 6.7.3 and ≤ 7.4.1
nvd netapp e-series performance analyzer generic any version

References

URLTags
https://github.com/grafana/grafana/blob/master/CHANGELOG.md Release Notes, Third Party Advisory
https://github.com/grafana/grafana/blob/master/CHANGELOG.md#742-2021-02-17 Release Notes, Third Party Advisory
https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/ Release Notes, Vendor Advisory
https://security.netapp.com/advisory/ntap-20210513-0007/ Third Party Advisory

Timeline
Published2021-03-18By the CVE Program.
VulnCheck KEV: earliest evidence2026-05-01Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-10Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.